Add Zip Archives password support by alinpahontu2912 · Pull Request #122093 · dotnet/runtime

alinpahontu2912 · 2025-12-02T14:58:58Z

Fixes #1545

Big Milestones and status:

Read Encrypted Entries (ZipCrypto, WinZip AES)
Create Encrypted Entries (ZipCrypto, Winzip AES)
Update Mode
Add runtime assets for checking compat with WinRar/7zip/WinZip/etc
Security check for Cryptography methods
Final API design

…assword and unprotected

… with cryptography lib

Copilot

Pull request overview

Copilot reviewed 41 out of 41 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 41 out of 41 changed files in this pull request and generated 4 comments.

Copilot

Pull request overview

Copilot reviewed 42 out of 42 changed files in this pull request and generated 7 comments.

bartonjs · 2026-05-08T22:41:14Z

+                }
+                else
+                {
+                    // For decryption: HMAC first (on ciphertext), then XOR


Since this data protocol correctly uses Encrypt-then-MAC (EtM), best practice (and internal security requirements) dictates that you should verify the MAC entirely before doing any decryption. As far as I can tell, this implementation allows decrypted data to be processed by a caller before the MAC is verified.

While that is the more performant approach, it will require a security process exception (ideally before the code is committed). Alternatively, change to verifying the MAC beforehand.

Maybe that discussion was already and and I'm not privy to it, but it's a flaw in implementation that I see here. cc: @blowdart @GrabYourPitchforks

Copilot

Pull request overview

Copilot reviewed 42 out of 42 changed files in this pull request and generated 8 comments.

+        private const string TestPassword = "test-password";
+        private const ushort PasswordVerifier = 0x1234;


+        private const string TestPassword = "test-password";
+        private const ushort PasswordVerifier = 0x1234;


+        private const string TestPassword = "test-password";
+


+        public async Task DecryptEntries_SamePassword_7Zip(bool async)
+        {
+            string password = "S3cur3P@ssw0rd";
+            using Stream archiveStream = await StreamHelpers.CreateTempCopyStream(passwordProtected("PasswordProtected_7ZIP_SamePassword.zip"));


…time into zip_password

Copilot

Pull request overview

Copilot reviewed 42 out of 42 changed files in this pull request and generated 7 comments.

+        public System.Threading.Tasks.Task<System.IO.Stream> OpenAsync(System.IO.FileAccess access, System.ReadOnlySpan<char> password, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) { throw null; }
        public System.Threading.Tasks.Task<System.IO.Stream> OpenAsync(System.IO.FileAccess access, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) { throw null; }
+        public System.Threading.Tasks.Task<System.IO.Stream> OpenAsync(System.ReadOnlySpan<char> password, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) { throw null; }


+                            var crcStream = GetDataCompressor(encryptionStream, leaveBackingStreamOpen: true, onClose: null, streamForPosition: _archive.ArchiveStream);
+                            await using (crcStream.ConfigureAwait(false))
+                            {
+                                _storedUncompressedData.Seek(0, SeekOrigin.Begin);
+                                await _storedUncompressedData.CopyToAsync(crcStream, cancellationToken).ConfigureAwait(false);
+                            }
+
+                            // Restore CompressionMethod - AesCompressionMethodValue is used directly when writing headers
+                            CompressionMethod = savedMethod;


+                BitFlagValues savedFlags = _generalPurposeBitFlag;
+                ZipEncryptionMethod savedEncryption = Encryption;
+                ZipCompressionMethod savedCompressionMethod = CompressionMethod;
+
+                // For AES entries: set CompressionMethod to Aes so header writes method 99,
+                // but clear _encryptionMethod so WriteLocalFileHeaderAsync doesn't create a new
+                // AES extra field (the original one in _lhUnknownExtraFields will be used).
+                if (savedEncryption is ZipEncryptionMethod.Aes128 or ZipEncryptionMethod.Aes192 or ZipEncryptionMethod.Aes256)
+                {
+                    CompressionMethod = (ZipCompressionMethod)WinZipAesMethod;
+                    Encryption = ZipEncryptionMethod.None;
+                }


+            if (overwrite && File.Exists(destinationFileName))
+            {
+                tempPath = Path.GetTempFileName();
+                extractPath = tempPath;
+            }


+        // When overwriting, extract to a temporary file first to avoid corrupting the destination file
+        // if an exception occurs during extraction (e.g., password-protected archive, corrupted data).
+        string extractPath = destinationFileName;
+        string? tempPath = null;
+
+        if (overwrite && File.Exists(destinationFileName))
+        {
+            tempPath = Path.GetTempFileName();
+            extractPath = tempPath;
+        }


+        ThrowIfInvalidArchive();
+        ValidateAccessForMode(access);
+
+        if (IsEncrypted && password.IsEmpty)


+
+                    ZipArchiveEntry lastEntry = _entries[_entries.Count - 1];
+                    if (lastEntry.IsEncrypted)
+                    {
+                        await lastEntry.ReadEncryptionSaltIfNeededAsync(cancellationToken).ConfigureAwait(false);
+                    }


GrabYourPitchforks

Holding the submission until necessary docs are submitted.

MihaZupan · 2026-06-10T14:03:33Z

+    private byte[] CopyToRentedArray(ReadOnlySpan<byte> bytes)
+    {
+        byte[] buffer = ArrayPool<byte>.Shared.Rent(bytes.Length);
+        try
+        {
+            bytes.CopyTo(buffer);
+            return buffer;
+        }
+        catch
+        {
+            ArrayPool<byte>.Shared.Return(buffer);
+            throw;
+        }
+    }


Suggested change

private byte[] CopyToRentedArray(ReadOnlySpan<byte> bytes)

{

byte[] buffer = ArrayPool<byte>.Shared.Rent(bytes.Length);

try

{

bytes.CopyTo(buffer);

return buffer;

}

catch

{

ArrayPool<byte>.Shared.Return(buffer);

throw;

}

}

private static byte[] CopyToRentedArray(ReadOnlySpan<byte> bytes)

{

byte[] buffer = ArrayPool<byte>.Shared.Rent(bytes.Length);

bytes.CopyTo(buffer);

return buffer;

}

CopyTo won't throw here, and if it did the cleanup doesn't matter since the fuzzer would stop anyway.

MihaZupan · 2026-06-10T14:03:56Z

+    private byte[] CopyToRentedArray(ReadOnlySpan<byte> bytes)
+    {
+        byte[] buffer = ArrayPool<byte>.Shared.Rent(bytes.Length);
+        try
+        {
+            bytes.CopyTo(buffer);
+            return buffer;
+        }
+        catch
+        {
+            ArrayPool<byte>.Shared.Return(buffer);
+            throw;
+        }
+    }


Suggested change

private byte[] CopyToRentedArray(ReadOnlySpan<byte> bytes)

{

byte[] buffer = ArrayPool<byte>.Shared.Rent(bytes.Length);

try

{

bytes.CopyTo(buffer);

return buffer;

}

catch

{

ArrayPool<byte>.Shared.Return(buffer);

throw;

}

}

private static byte[] CopyToRentedArray(ReadOnlySpan<byte> bytes)

{

byte[] buffer = ArrayPool<byte>.Shared.Rent(bytes.Length);

bytes.CopyTo(buffer);

return buffer;

}

MihaZupan · 2026-06-10T14:16:22Z

+            }
+
+            ZipArchiveEntry entry;
+            if (!password.IsEmpty && encryption != ZipEncryptionMethod.None)


Suggested change

if (!password.IsEmpty && encryption != ZipEncryptionMethod.None)

if (encryption != ZipEncryptionMethod.None)

Already checked above

MihaZupan · 2026-06-10T14:26:02Z

+                if (!password.IsEmpty)
+                    ExtractToFile(source, fileDestinationPath, overwrite, password);
+                else
+                    source.ExtractToFile(fileDestinationPath, overwrite: overwrite);


Nit: Please use blocks with {} in such if/else cases.

MihaZupan · 2026-06-10T14:34:07Z

+    /// The key material layout is: [salt][encryption key][HMAC key][password verifier (2 bytes)].
+    /// </summary>
+    [UnsupportedOSPlatform("browser")]
+    internal readonly struct WinZipAesKeyMaterial


If using struct here is about perf, it may actually be worse since it's quite large and you're passing it around in arguments a bunch

MihaZupan · 2026-06-10T14:51:48Z

+            int inputOffset = 0;
+            int inputCount = buffer.Length;


Instead of tracking the offsets and count, you can slice the buffer (same for the memory in async variant).
You get to drop the extra locals, and the loop condition is !IsEmpty.

MihaZupan · 2026-06-10T14:53:12Z

+                if (isAsync)
+                    await WriteHeaderAsync(cancellationToken).ConfigureAwait(false);
+                else
+                    WriteHeader();


Nit: {} blocks (same in all other places)

MihaZupan · 2026-06-10T14:56:02Z

+            // Only flush if the base stream supports writing
+            if (_baseStream.CanWrite)


Why are we checking this? Wouldn't it be the caller's error / the responsibility of the base stream to check?

We aren't doing the same in ZipCryptoStream for example

MihaZupan · 2026-06-10T15:07:55Z

+        private bool IsZipCryptoEncrypted => (_generalPurposeBitFlag & BitFlagValues.IsEncrypted) != 0 && (ushort)_headerCompressionMethod != WinZipAesMethod;
+
+        private bool UseAesEncryption()
+        {
+            return Encryption is ZipEncryptionMethod.Aes128 or ZipEncryptionMethod.Aes192 or ZipEncryptionMethod.Aes256;
+        }
+        private bool IsAesEncrypted => (ushort)_headerCompressionMethod == WinZipAesMethod;


Nit: Any reason between property vs method here?

MihaZupan · 2026-06-10T15:13:25Z

+            int offset = 0;
+
+            while (offset < buffer.Length)


Same here re: slicing instead of tracking the offset

alinpahontu2912 added 22 commits October 20, 2025 15:38

working zipcrypto, hardcoded password

527c698

add tests with multiple entries with same password and entries with p…

255642b

…assword and unprotected

reading/extracting experimentation and tests

968bb60

add enum for encryption and write methods for zipcrypto stream

19cbc8e

allow encryption of entries

0dec737

add more read/write tests for update mode and small refactors

f30fbfb

add default password and encryption method to ziparchive

aac140b

avoid ambigous calls

eb1a460

avoid ambigous calls and fi some nitpicks

0a7c885

recognize aes encrypted files + build fais due to circular dependency…

817165c

… with cryptography lib

fixed some comments

797921d

remove storing password fields

623f238

initial reading of winzip encrypted files

b61b37c

address zipcrypto comments

122f85a

initial writing test works

55c0613

add more tests for winzipaesstream and work on async methods

cc6d30d

Merge remote-tracking branch 'upstream/main' into zip_password

b056780

async methods done, fix ae-1 validation and add more tests

6732696

Solve some comments

8efa772

refactor tests and ci disable local ones

d5bb294

improve winzipaesstream writing by generating larger keystream

0c659fc

update tests, fixed async opening and updated stream positioning

e2b21ff

github-actions Bot added the area-System.IO.Compression label Dec 2, 2025

dotnet-policy-service Bot assigned alinpahontu2912 Dec 2, 2025

Merge branch 'main' into zip_password

dbcee70

rzikm self-requested a review December 11, 2025 12:22

Merge branch 'main' into zip_password

ff9160b

Merge branch 'main' into zip_password

d759bc3

Copilot AI review requested due to automatic review settings April 30, 2026 10:39

Copilot started reviewing on behalf of alinpahontu2912 April 30, 2026 10:39 View session

Copilot AI reviewed Apr 30, 2026

View reviewed changes

Comment thread src/libraries/System.IO.Compression/src/System/IO/Compression/ZipArchiveEntry.Async.cs

Comment thread src/libraries/System.IO.Compression/src/System/IO/Compression/ZipArchiveEntry.Async.cs Outdated

fix copilot comments

53aba0b

alinpahontu2912 requested a review from rzikm April 30, 2026 12:21

build-analysis Bot mentioned this pull request Apr 30, 2026

IL3050/IL2026 - StringTests, TimeZoneInfoTests fail AOT/trimmer analysis in System.Runtime.IOS.Tests #127445

Closed

fix trimming warnings

22a5c72

Copilot AI review requested due to automatic review settings May 7, 2026 10:04

Copilot started reviewing on behalf of alinpahontu2912 May 7, 2026 10:04 View session

Copilot AI reviewed May 7, 2026

View reviewed changes

alinpahontu2912 and others added 2 commits May 7, 2026 15:23

add tests based on runtime assets

8177578

Merge branch 'dotnet:main' into zip_password

8f8eae7

Copilot AI review requested due to automatic review settings May 7, 2026 13:27

Copilot started reviewing on behalf of alinpahontu2912 May 7, 2026 13:27 View session

Copilot AI reviewed May 7, 2026

View reviewed changes

bartonjs requested changes May 8, 2026

View reviewed changes

alinpahontu2912 and others added 2 commits May 11, 2026 13:44

address comments

992331a

Merge branch 'dotnet:main' into zip_password

9a2889f

Copilot AI review requested due to automatic review settings May 12, 2026 08:34

Copilot started reviewing on behalf of alinpahontu2912 May 12, 2026 08:34 View session

Copilot AI reviewed May 12, 2026

View reviewed changes

alinpahontu2912 added 3 commits May 12, 2026 13:24

solve stackalloc unsafe exceptions

3a69edd

Merge branch 'zip_password' of https://github.com/alinpahontu2912/run…

ee1c719

…time into zip_password

add missing unsafe keyword

c423b79

Copilot AI review requested due to automatic review settings May 12, 2026 14:04

Copilot started reviewing on behalf of alinpahontu2912 May 12, 2026 14:05 View session

Copilot AI reviewed May 12, 2026

View reviewed changes

GrabYourPitchforks requested changes May 25, 2026

View reviewed changes

MihaZupan reviewed Jun 10, 2026

View reviewed changes

		private const string TestPassword = "test-password";
		private const ushort PasswordVerifier = 0x1234;

	if (!password.IsEmpty && encryption != ZipEncryptionMethod.None)
	if (encryption != ZipEncryptionMethod.None)

		// Only flush if the base stream supports writing
		if (_baseStream.CanWrite)

Conversation

alinpahontu2912 commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

GrabYourPitchforks left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

alinpahontu2912 commented Dec 2, 2025 •

edited

Loading

GrabYourPitchforks left a comment •

edited

Loading